refactor: improve docker compose validation and transaction handling in StackForm

tests/Unit/VolumeArrayFormatSecurityTest.php

@@ -194,6 +194,36 @@ YAML;
         ->not->toThrow(Exception::class);
 });
 
+test('array-format with environment variable and path concatenation', function () {
+    // This is the reported issue #7127 - ${VAR}/path should be allowed
+    $dockerComposeYaml = <<<'YAML'
+services:
+  web:
+    image: nginx
+    volumes:
+      - type: bind
+        source: '${VOLUMES_PATH}/mysql'
+        target: /var/lib/mysql
+      - type: bind
+        source: '${DATA_PATH}/config'
+        target: /etc/config
+      - type: bind
+        source: '${VOLUME_PATH}/app_data'
+        target: /app/data
+YAML;
+
+    $parsed = Yaml::parse($dockerComposeYaml);
+
+    // Verify all three volumes have the correct source format
+    expect($parsed['services']['web']['volumes'][0]['source'])->toBe('${VOLUMES_PATH}/mysql');
+    expect($parsed['services']['web']['volumes'][1]['source'])->toBe('${DATA_PATH}/config');
+    expect($parsed['services']['web']['volumes'][2]['source'])->toBe('${VOLUME_PATH}/app_data');
+
+    // The validation should allow this - the reported bug was that it was blocked
+    expect(fn () => validateDockerComposeForInjection($dockerComposeYaml))
+        ->not->toThrow(Exception::class);
+});
+
 test('array-format with malicious environment variable default', function () {
     $dockerComposeYaml = <<<'YAML'
 services:

tests/Unit/VolumeSecurityTest.php

@@ -94,6 +94,27 @@ test('parseDockerVolumeString accepts simple environment variables', function ()
     }
 });
 
+test('parseDockerVolumeString accepts environment variables with path concatenation', function () {
+    $volumes = [
+        '${VOLUMES_PATH}/mysql:/var/lib/mysql',
+        '${DATA_PATH}/config:/etc/config',
+        '${VOLUME_PATH}/app_data:/app',
+        '${MY_VAR_123}/deep/nested/path:/data',
+        '${VAR}/path:/app',
+        '${VAR}_suffix:/app',
+        '${VAR}-suffix:/app',
+        '${VAR}.ext:/app',
+        '${VOLUMES_PATH}/mysql:/var/lib/mysql:ro',
+        '${DATA_PATH}/config:/etc/config:rw',
+    ];
+
+    foreach ($volumes as $volume) {
+        $result = parseDockerVolumeString($volume);
+        expect($result)->toBeArray();
+        expect($result['source'])->not->toBeNull();
+    }
+});
+
 test('parseDockerVolumeString rejects environment variables with command injection in default', function () {
     $maliciousVolumes = [
         '${VAR:-`whoami`}:/app',